---
title: "42 U.S.C. 1320d–8 HIPAA: Processing payment transactions by financial institutions"
canonical: "https://dposchool.com/hipaa/section/1320d-8"
source: "https://uscode.house.gov/us/usc/119-136/t42/s1320d-8/"
source_note: "Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 45, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR."
text_as_of: "2026-10-22"
language: "en"
publisher: "DPO School"
---

42 U.S.C. 1320d–8 HIPAA · Chapter 7: SOCIAL SECURITY

# 42 U.S.C. 1320d–8 HIPAA: Processing payment transactions by financial institutions

United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026.

## Official text

To the extent that an entity is engaged in activities of a financial institution (as defined in section 3401 of title 12), or is engaged in authorizing, processing, clearing, settling, billing, transferring, reconciling, or collecting payments, for a financial institution, this part, and any standard adopted under this part, shall not apply to the entity with respect to such activities, including the following:

#### 42 U.S.C. 1320d–8(1)

**(1)** The use or disclosure of information by the entity for authorizing, processing, clearing, settling, billing, transferring, reconciling or collecting, a payment for, or related to, health plan premiums or health care, where such payment is made by any means, including a credit, debit, or other payment card, an account, check, or electronic funds transfer.

#### 42 U.S.C. 1320d–8(2)

**(2)** The request for, or the use or disclosure of, information by the entity with respect to a payment described in paragraph (1)⁠—

##### 42 U.S.C. 1320d–8(2)(A)

**(A)** for transferring receivables;

##### 42 U.S.C. 1320d–8(2)(B)

**(B)** for auditing;

##### 42 U.S.C. 1320d–8(2)(C)

**(C)** in connection with⁠—

###### 42 U.S.C. 1320d–8(2)(C)(i)

**(i)** a customer dispute; or

###### 42 U.S.C. 1320d–8(2)(C)(ii)

**(ii)** an inquiry from, or to, a customer;

##### 42 U.S.C. 1320d–8(2)(D)

**(D)** in a communication to a customer of the entity regarding the customer’s transactions, payment card, account, check, or electronic funds transfer;

##### 42 U.S.C. 1320d–8(2)(E)

**(E)** for reporting to consumer reporting agencies; or

##### 42 U.S.C. 1320d–8(2)(F)

**(F)** for complying with⁠—

###### 42 U.S.C. 1320d–8(2)(F)(i)

**(i)** a civil or criminal subpoena; or

###### 42 U.S.C. 1320d–8(2)(F)(ii)

**(ii)** a Federal or State law regulating the entity.

## Source

Source: United States Code, title 42, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced.

Source credit: ( Aug. 14, 1935, ch. 531 , title XI, § 1179, as added Pub. L. 104-191, title II, § 262(a) , Aug. 21, 1996 , 110 Stat. 2030 .)

[42 U.S.C. 1320d–8 on the Office of the Law Revision Counsel](https://uscode.house.gov/us/usc/119-136/t42/s1320d-8/)

United States Code, current through Public Law 119-136 (October 22, 2026). Retrieved 30 October 2026.

This is reference material, not legal advice.

## Navigation

[HIPAA Navigator](https://dposchool.com/hipaa) / 42 U.S.C. 1320d–8

Previous: [42 U.S.C. 1320d–7 HIPAA: Effect on State law](https://dposchool.com/hipaa/section/1320d-7)

Next: [42 U.S.C. 1320d–9 HIPAA: Application of HIPAA regulations to genetic information](https://dposchool.com/hipaa/section/1320d-9)

## For AI agents

- Machine-readable index: https://dposchool.com/hipaa/llms.txt
- JSON API: https://dposchool.com/hipaa/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents